diff --git a/pkgbuilds/hermes-desktop/PKGBUILD b/pkgbuilds/hermes-desktop/PKGBUILD
index b854973..6d52e53 100644
--- a/pkgbuilds/hermes-desktop/PKGBUILD
+++ b/pkgbuilds/hermes-desktop/PKGBUILD
@@ -42,10 +42,12 @@ depends=(
   'libxkbcommon'
   'libxrandr'
   'mesa'
+  'mise'
   'nspr'
   'nss'
   'pango'
   'systemd-libs'
+  'uv'
   'xdg-utils'
 )
 
@@ -71,7 +73,7 @@ source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz
         'hermes-desktop.desktop'
         'hermes-desktop.png')
 sha256sums=('1e3d39d3638ec15fa9d31af262568a953e9272090deb1c50c44cd401175f5b80'
-            'bac4626a3bbde4c05cf6072c05f6c47d1804c99066e04ee5328cea707fae1a3f'
+            'e7c0e1fd343e9b013de4575fbefdd4f03b3b62fb5c2c2dd3c508f4a26b6608ea'
             '3ef685bfcf366776b025d26c37d32854d8d4aa2023b2bd07c8e08b001ef1e8c4'
             'd60d164e24fdcf6532133b8ea43c77a201e4b9e9dbc396187b58d51d8590ef52')
 
diff --git a/pkgbuilds/hermes-desktop/hermes-desktop.sh b/pkgbuilds/hermes-desktop/hermes-desktop.sh
index 0ffbe18..8bfbcd2 100644
--- a/pkgbuilds/hermes-desktop/hermes-desktop.sh
+++ b/pkgbuilds/hermes-desktop/hermes-desktop.sh
@@ -2,22 +2,35 @@
 set -euo pipefail
 
 # The desktop app is only a shell: it runs `hermes serve` against a Hermes CLI
-# it does not ship. Finding none, it clones its own copy with the upstream
-# install script -- an unpinned checkout in ~/.hermes that no package manages.
+# it does not ship. Finding none it offers to install its own, which clones an
+# unpinned checkout into ~/.hermes/hermes-agent -- and that copy then wins
+# forever, because the app checks ~/.hermes before it checks PATH.
 #
-# command -v rather than omarchy-cmd-present: no other launcher in this repo
-# makes a package depend on omarchy, and this has to behave on a plain Arch box.
-# Run the installer even when hermes is already on PATH. A stub can be there
-# and cold, and `mise up` can leave one pointing at a Hermes built against the
-# wrong Python; repairing either costs minutes, and the app allows 15 seconds
-# before it gives up and bootstraps. Installing here is a no-op when healthy.
+# So guarantee the CLI here rather than relying on anything else having run.
+
+tool='pipx:hermes-agent[extras=all]'
+python='3.13'
+
+# Hermes declares Requires-Python <3.14; left to itself uv builds the venv
+# against Arch's 3.14 anyway and only fails later, inside a dependency. The
+# cooldown override is exported so the version resolved to run is the one just
+# installed. Both mirror omarchy-install-hermes-cli -- keep them in step.
+export UV_PYTHON="$python"
+export MISE_MINIMUM_RELEASE_AGE=0
+
 if command -v omarchy-install-hermes-cli >/dev/null 2>&1; then
   omarchy-install-hermes-cli --now
-elif ! command -v hermes >/dev/null 2>&1; then
-  echo "The Hermes CLI is not installed, so Hermes Desktop will install its" >&2
-  echo "own copy under ~/.hermes. Install the CLI first to avoid that." >&2
+elif ! [[ -d "$(mise where "$tool" 2>/dev/null)/hermes-agent/lib/python$python" ]]; then
+  echo "Installing the Hermes CLI (this takes a minute)..." >&2
+  mise use -g --quiet --force "$tool" || true
 fi
 
+# Hand the app the real executable rather than leaving it to search. Its PATH
+# probe allows 15 seconds, which nothing that still has installing to do can
+# meet.
+hermes_bin="$(mise where "$tool" 2>/dev/null)/bin"
+[[ -d $hermes_bin ]] && export PATH="$hermes_bin:$PATH"
+
 # Chromium's own Ozone detection falls back to XWayland often enough to matter,
 # and the result is a blurry window on every scaled display. Ask for Wayland
 # directly, unless the user has already picked a platform themselves.